Description

WordPress’s login page, admin AJAX endpoint, REST API, and core files are among the most commonly scanned and attacked surfaces on the web, simply because so many sites run WordPress. Most visitors to a typical site only ever read content. Camouflage Security takes the position that if a request is not something the site actually needs to serve dynamically, it should not reach WordPress at all, and if it is, it should only be reachable after an administrator has explicitly reviewed and allowed it.

Camouflage Security disables PHP for public visitors. Attackers routinely target PHP written by themes and plugins, and even by WordPress core itself. When public requests never reach PHP, most of those attacks simply cannot happen, which significantly improves your website’s security.

How it works

A built in crawler walks the site’s sitemap and internal links and saves a static HTML snapshot of every page it finds.
.htaccess serves those static files directly to visitors, so most requests never boot PHP or WordPress at all.
Anything that cannot be served statically, such as an unrecognized path, an AJAX call, or a form submission, is blocked with a 404 by default until an administrator explicitly allows it.
Logged in administrators automatically receive a signed bypass cookie, so they always see the live, editable site instead of the static cache.

Features

Static page caching

Pages are crawled and saved as plain HTML, then served by .htaccess with no PHP execution for cache hits. Content updates automatically invalidate the relevant cached page.

Login and core file lockdown

wp-login.php and every other standalone WordPress core script at the site root are blocked for anyone without the admin bypass cookie or a one time login unlock link, closing off the most commonly targeted entry points.

AJAX endpoint disguising

admin-ajax.php is given a decoy public path (`/assets/sync` by default, configurable) that quietly proxies to the real endpoint, so cached pages never reveal the real WordPress AJAX URL.

Optional asset and URL rewriting

When enabled, theme, plugin, and core script, style, and image URLs are mirrored into the static cache under hashed filenames, so cached pages never reveal which theme or plugins are installed, or that the site runs WordPress at all.

Dynamic request tracking and allow listing

Every blocked request can be reviewed in the admin and explicitly allowed. Rules match on path, HTTP method, and the set of field names involved, not exact values, so a real form keeps working no matter what a visitor types into it.

Admin access tools

A signed bypass cookie is issued automatically on login. A backup login URL and a downloadable backup file are provided so an administrator can always get back in even if their browser cookie is lost.

Open Source

Camouflage Security is open source and contributions are welcome. Visit the GitHub repository to report issues, suggest features, or submit a pull request.

Installation

Upload the plugin to wp-content/plugins/camouflage, or clone this repository directly into that directory.
Activate it from the Plugins screen in wp-admin.
The plugin requires Apache with mod_rewrite enabled. It writes its own rules directly into .htaccess. It does not currently support nginx, since nginx does not read .htaccess files. An equivalent server block would need to be configured manually.

FAQ

What happens to normal content pages?: Regular content pages are never blocked, only cached. Blocking only ever applies to requests WordPress itself could not resolve, AJAX calls, and POST submissions such as forms and comments.
Will it work on nginx?: No. The plugin relies on Apache’s .htaccess files, which nginx does not read. An equivalent server block would need to be configured manually.
Does disabling tracking stop requests from being blocked?: No. Blocking is never affected by the tracking setting. Tracking only controls whether blocked requests are also logged to the Tracked Requests tab.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Camouflage Security” is open source software. The following people have contributed to this plugin.

Hamza Mairaj

Translate “Camouflage Security” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.0.1

Resolve the AJAX endpoint and cache directory dynamically (admin_url() and wp_upload_dir()) so the plugin works in non-standard WordPress setups.
Store the static cache in a plugin-slug folder inside the uploads directory.
Renamed the plugin display name to Camouflage Security.

1.0.0

Initial release.